The Model Found a Thousand Problems. Who's Going to Fix Them?
Point a capable model at an existing operation and it will find problems faster than the organization can fix them. Bank of America just put a price on that. After frontier models surfaced flaws in code the bank and its vendors run, it assigned about three thousand of its own people to the fix and then brought in roughly a thousand contractors on top, and its third quarter carried a couple hundred million dollars plus in remediation costs as a result. The model did exactly what it was asked to do. The bill came from what happened next. Every organization has a rate at which it can act on what AI finds, and above that rate a finding stops being an asset and becomes an unfunded obligation. We call that rate the remediation ceiling, and most companies are about to hit theirs without having measured it.
What is the remediation ceiling?
It's the maximum rate at which an organization can act on the findings AI produces. Below it, findings are value. Above it, findings are liabilities.
The ceiling is set by the fix side, never the find side. Engineers who can patch, lawyers who can amend, operators who can change a process, budget owners who can approve the change. Those people and their hours are a fixed quantity in any given quarter. AI didn't change that quantity. It changed the other side of the equation, the rate at which problems get surfaced, by orders of magnitude, and it did so in a way that leaves a record. A vulnerability you hadn't found yet was a risk. A vulnerability a model found, logged, and reported to you is a known defect with a timestamp, and known defects carry duties that unknown ones don't. The ceiling is where your capacity to discharge those duties runs out.
Why is this showing up now?
Because the models got good enough to audit whole estates, and the estates were never built to be audited at that rate.
Security is the first place the ceiling is visible, because it's where the stakes made someone count. One large bank's CEO said cyber risk went up tenfold after the latest model generation, and the response across the sector has been to roll up sleeves and patch. But the same pattern applies anywhere you point a model at accumulated work. A code review agent reads a decade-old codebase and files thousands of legitimate issues. A compliance agent reads every contract and flags every clause that drifted from policy. A data quality agent walks the warehouse and returns a list longer than the team that would fix it. None of these are false positives. That's the problem. The backlog was always there. What changed is that it's now enumerated, and an enumerated backlog is a management decision you can no longer avoid.
Isn't this just the reading tax again?
No. The reading tax is output nobody can consume. The remediation ceiling is findings nobody can fix, and a finding carries an obligation a document doesn't.
We wrote about the reading tax, the attention everyone else pays to consume what AI made cheap to produce. That cost is diffuse and mostly reversible. Nobody is on the hook for an unread brief. A finding is different in kind. Once a model has told you that a system is exposed, a contract is non-compliant, or a record is wrong, the organization knows, and knowing creates duties toward regulators, customers, auditors, and in some cases courts. The reading tax costs you attention. The ceiling costs you the gap between what you now know and what you can prove you did about it. It also sits in the same family as the batch ceiling and the supervision ceiling, where a system's value is capped by its slowest component. Here the slowest component is the humans who fix things.
Why can't you just hire your way through it?
You can, for a while, and the bank did. But contracted capacity treats the symptom, and the finding rate doesn't stop climbing.
A thousand contractors is a real answer to a real backlog, and for a regulated firm facing known vulnerabilities it may have been the only answer. It's also a one-time surge against a rate that compounds. The next model generation will find more, faster, in more domains, and surge hiring against each one turns the ceiling into a permanent cost line that scales with model capability instead of with your business. The bank itself expects its share of these costs to shrink now that the people are in place, and that's the right expectation for the first wave. The question for everyone else is what happens on the second and third, when the findings come from legal, operations, and finance at once, and the people who can fix them aren't contractors you can rent.
Does this mean you should look less?
No. It means you should decide what you're prepared to fix before you decide what to scan, and scope the scan to that.
The tempting response to the ceiling is to stop pointing models at the estate, and that's the wrong lesson, because the problems exist whether or not you enumerate them. The right lesson is sequencing. Most companies run discovery first and remediation planning second, which is how a bank ends up with a thousand contractors in a quarter. Run it the other way. Decide the remediation capacity you have, in people and budget, for each domain. Rank the findings you'd most need to act on by what a wrong one costs, which is a consequence line call. Then scope the scan to produce findings at roughly the rate you can clear them, starting with the highest-consequence domain, and widen the aperture as capacity frees up. Discovery is cheap now and discharge is not, so the scan gets sized to the discharge.
What should you do about the remediation ceiling?
The question you're really asking is how to get the value of AI findings without taking on obligations you can't meet. The answer is to fund the fix side before you turn on the find side.
Three moves, in order. First, measure the ceiling. For each domain where you're about to deploy a finding-class agent, count the people who can actually act on its output and the hours they have. That number is your rate, and it's almost always smaller than the finding rate by an order of magnitude. Second, build the triage before the scan. Every finding lands in a queue with an owner, a consequence rank, and a decision, which can be fix, accept, or defer with a reason, so that knowing something becomes a documented choice rather than an open exposure. Third, raise the ceiling where it pays. The same models that find problems can draft fixes, and an agent that proposes a patch for a human to approve moves the ceiling far more than another contractor does. That's where we'd put the money. Knowing about a problem is only an advantage when it arrives at a rate you can afford to act on, and the rate is yours to set.
If you want your finding-class agents scoped to the capacity you can actually fund, start with an AI Blueprint or reach us at contact@theyor.com